djadhere/accounts/admin.py

from django.contrib import admin
from django.contrib.auth.models import User
from django.contrib.auth.admin import UserAdmin as AuthUserAdmin
from django.core.exceptions import PermissionDenied


from .forms import UserCreationForm
from adhesions.admin import ProfileInline, AdherentInline


class UserAdmin(AuthUserAdmin):
    def get_readonly_fields(self, request, obj=None):
        readonly_fields = super().get_readonly_fields(request, obj)
        if obj and not request.user.is_superuser:
            readonly_fields += ('username',)
        return readonly_fields

    def get_fieldsets(self, request, obj=None):
        if request.user.is_superuser:
            return super().get_fieldsets(request, obj)
        if obj:
            return (
                AuthUserAdmin.fieldsets[0], # Note: password is mandatory (but readonly)
                AuthUserAdmin.fieldsets[1],
            )
        else:
            return (
                (None, {'fields': ('username',)}),
                AuthUserAdmin.fieldsets[1],
            )

    def get_form(self, request, obj=None):
        # get_inlines does not exists :-(
        if obj:
            self.inlines = (ProfileInline, AdherentInline,)
        else:
            self.inlines = ()

        if request.user.is_superuser or obj:
            return super().get_form(request, obj)
        else:
            # This creation form does not ask for a password
            return UserCreationForm

    def user_change_password(self, request, id):
        if not request.user.is_superuser:
            raise PermissionDenied
        return super().user_change_password(request, id)


admin.site.unregister(User)
admin.site.register(User, UserAdmin)